Beispielereignisnachricht für Sophos Central
Die folgenden Beispielereignisse stammen aus dem Sophos Central, wenn Sie das Sophos Central-Protokoll verwenden.
Ereignis-Endpunkt
In der folgenden Beispielereignisnachricht gibt das Ereignis die Ergebnisse einer Aktion an, die die Details dieses von Sophos Central generierten Ereignisses zurückgibt.
{"source":"n/a","when":"2024-04-23T16:22:10.159Z","severity":"low","type":"Event::Endpoint::UpdateRebootRequired","location":"AA1AAAA-1234AAA1","id":"111111aa-1a0a-11aa-a111-1111a1a01a11","group":"UPDATING","endpoint_id":"111111aa-1a0a-11aa-a111-1111aaaaaaa","endpoint_type":"server","customer_id":"111111aa-1a0a-11aa-a111-1111a1a01a11","created_at":"2024-04-23T16:22:10.170Z","source_info":{"ip":"10.0.0.1"},"name":"Reboot to complete update; computer stays protected in the meantime"}
| QRadar Feldname | Hervorgehobener Nutzdatenfeldname |
|---|---|
| Ereignis-ID | type |
| Quellen-IP | source_info.ip |
| Einheitenzeit | created at |
| Wertigkeit | severity |
Alert-Endpunkt
In der folgenden Beispielereignisnachricht gibt das Ereignis die Ergebnisse einer Aktion an, die die Details des von Sophos Central generierten Alerts zurückgibt.
{"javaUUID":"111111aa-1a0a-11aa-a111-1111a1a01a11","source":"EndpointDevice-\\test","description":"Manual PUA cleanup required: 'PsKill' at 'C:\\test\\test\\Desktop\\testSuite.zip'","severity":"medium","when":"2024-05-17T08:27:35.081Z","data":{"core_remedy_items":{"totalItems":1,"items":[{"result":"FAILED_TO_DELETE","sophosPid":"","suspendResult":"NOT_APPLICABLE","processPath":"","descriptor":"C:\\test\\test\\Desktop\\testSuite.zip\\test.exe","type":"file"}]},"created_at":1715934458355,"endpoint_id":"111111aa-1a0a-11aa-a111-1111a1a01a11","endpoint_java_id":"111111aa-1a0a-11aa-a111-1111a1a01a11","endpoint_platform":"windows","endpoint_type":"computer","event_service_id":{"type":3,"data":"+t8G5vc+TxiW3IX3C/RrhQ=="},"inserted_at":1715934458355,"source_app_id":"TEST","source_info":{"ip":"10.0.0.1"},"threat_id":{"timestamp":1715934441,"date":1715934441000},"threat_status":"CLEANUP_FAILED","user_match_id":{"timestamp":1697208869,"date":1697208869000},"user_match_uuid":{"type":3,"data":"aaaaaaaa/aaaa111111"}},"type":"Event::Endpoint::CorePuaCleanFailed","location":"EndpointDevice-","id":"111111aa-1a0a-11aa-a111-1111a1a01a11","actionable":false,"customer_id":"111111aa-1a0a-11aa-a111-1111a1a01a11","created_at":"2024-05-17T08:27:38.371Z","threat":"PsKill","threat_cleanable":false,"event_service_event_id":"111111aa-1a0a-11aa-a111-1111a1a01a11"}
| QRadar Feldname | Hervorgehobener Nutzdatenfeldname |
|---|---|
| Ereignis-ID | type |
| Quellen-IP | data. source_info.ip |
| Einheitenzeit | created at |
| Wertigkeit | severity |